Center for
Mathematical Economics
Working Papers
537
March 2015
Network Design and Imperfect Defense
Jakob Landwehr
Center for Mathematical Economics (IMW) Bielefeld University
Universit¨atsstraße 25 D-33615 Bielefeld · Germany
Network Design and Imperfect Defense
Jakob Landwehr
∗March 4, 2015
The question how to optimally design an infrastructure network that may be subject to intelligent threats is of highest interest. We address this problem by considering a Designer-Adversary game of optimal network design for the case of imperfect node defense. In this two-stage game, first the Designer defends network connectiv-ity by forming costly links and additionally protecting nodes. Then, the Adversary attacks a fixed number of nodes, aiming to discon-nect the network. In contrast to the existing literature, defense is imperfect in the sense that defended nodes can still be destroyed with some fixed probability.
We completely characterize the solution of the game for attack bud-gets of one and two nodes, while for larger budget we present a partial characterization of the solution. To do so, we determine the minimum number of links necessary to construct a network with any degree of connectivity and any given number of essential nodes.
Keywords: Network Design, Network Defense, Designer-Adversary Games, Node Destruction
JEL-Classification: C69, C72, D85.
∗
Center for Mathematical Economics, Bielefeld University, postbox 100131, D-33501 Biele-feld, Germany. Email: [email protected], phone: +49 521 106 4918. The author gratefully acknowledges funding by the German Research Foundation (DFG) under contract GRK 1134/2.
1 Introduction
Infrastructure networks are a crucial part of the modern society. Airports, internet servers and distribution centers are only some examples. Given this evident importance, the question arises how one should design such networks to optimally defend them against threats like intelligent attacks or natural dis-asters.
We propose a model of network design with two players, borrowed from
Dzi-ubi´nski and Goyal (2013). The first player, called the Designer, forms costly
bilateral links within a given set of nodes. She may also protect nodes against deletion, however protection is imperfect. The second player, called the Adver-sary, can then attack a fixed number of nodes, where unprotected nodes along with their respective links are deleted with certainty, protected nodes only with some given probability. The Designer intends to retain a connected residual network after the attack, while the Adversary has the opposing goal.
We aim to characterize equilibrium solutions of the resulting extensive-form zero-sum game. That is, we want to identify the set of possible equilibrium defended networks, all networks the Designer may construct contingent of the model’s priors: the attack budget of the adversary, the costs of link formation and defense, and the probability of deletion of defended links.
It is important to understand that in the proposed model the Designer has two defense mechanisms at hand. First, she may decide to directly defend nodes against deletion. Second, she may increase the connectivity of the network to defend it against separation. Thus it is on the one hand possible to design a network of sufficiently high connectivity such that direct node defense is not necessary, on the other hand a minimally connected network with all nodes being protected, or even some intermediate solutions will turn out to be also possibly optimal. This tradeoff between two substitutable defense mechanisms is a key characteristic of the model.
In a first step we fully characterize the set of equilibrium defended networks for attack budgets of one or two nodes. In case the Adversary can attack one node we show that the possible equilibrium defended networks are the empty network, the centrally-protected star and the non-protected circle (Proposition 1). Protected nodes will be present in equilibrium only for high chances of defense and small network size (Corollary 1).
For an attack budget of two nodes the possible equilibrium defended networks are the empty network, the centrally-protected star, the fully protected circle and the Harary graph of order 3, as well as one or two networks with an inter-mediate number of defended nodes (Proposition 3).
As for a general attack budget of ka nodes, we aim to limit the set of possible
equilibrium defended networks by using the same strategies as before in order to identify all non-connected, 1-connected and maximally connected possible
equilibrium defended networks (Lemma 4), as well as a set of ka-connected
The paper also contributes to the literature of graph theory, generalizing an early and seminal result of Harary (1962), who gives the minimum number
of links needed to construct a network with a given degree of connectedness.1
Here, we determine the minimum number of links necessary to construct a network with a given degree of connectedness and a given number of essential nodes (Proposition 2, Proposition 4 and Conjecture 1). Essential nodes are those nodes whose deletion will result in a strictly less connected network. Related literature
This paper is connected to two strands of literature. The first and obvious is the literature on network design, where various papers contributed in the last
years. Closest to this work are Dziubi´nski and Goyal (2013), who solve the
same model we look at here, but for perfect node defense. In Goyal and Vigier (2013) and Cerdeiro et al. (2015) contagion is added, i.e. all undefended nodes connected to an attacked node will also be deleted. In Goyal and Vigier (2010) the players decide on sizes of attack and defense, while the node destruction is decided with a Tullock contest. Among others, Hoyer and De Jaegher (2010) look at node and link deletion, but disregard defense in their model. Finally, in the case of decentralized defense (see e.g. Dziubinski and Goyal, 2013; Hoyer, 2012) any node is assumed to be a rational agent, aiming to protect itself against deletion.
The second, older strand of literature is the graph theoretic literature on con-nectedness, where Harary (1962) provided an early seminal contribution, iden-tifying the minimum number of links necessary to construct a network of given degree of connectedness.
The rest of the paper is organized as follows. Section 2 presents the model, while Section 3 presents the easily accessible solution for an attack budget of one. In Section 4 the solution of the game for an attack budget of two is characterized, while in Section 5 the same ideas are used for a partial characterization of the solution in case of a general attack budget. Section 6 finally concludes.
2 The Model
We want to introduce imperfect defense into the network design model of
Dz-iubi´nski and Goyal (2013). In order to do so consider the following. Let N
be a given set of nodes with cardinality n. A link (edge) between two nodes i, j ∈ N is denoted by ij, and we define the complete network (graph) by
gN = {ij | i, j ∈ N }, i.e. the network where any two nodes are linked. Finally,
we can now define the set of all networks G = {g | g ⊆ gN}.
This model is defined as follows. There are two players, the Designer and the Adversary, playing a two-stage game. In the first stage the Designer chooses
1
A network is said to be connected of degree k if it cannot be disconnected by deleting any k − 1 nodes along with their respective links.
network g, where each link comes at a constant and exogenously given cost cl.
At the same time she also may defend nodes at a cost cd. Denote the set of these
nodes by D ⊆ N . In the second stage, the Adversary, having an exogenously
given attack budget ka, chooses which ka nodes to attack, denoted by A ⊆ N .
Unprotected nodes are destroyed with probability 1, while protected nodes are destroyed with probability π ∈ (0, 1). Like this, for the case π = 0 we obtain
exactly the model of Dziubi´nski and Goyal (2013).
In the paper at hand we will study the Connectivity Game, i.e. we study the case that the Designer aims to retain a connected residual network, while the
Adversary tries to disconnect the network.2 Defining X to be the set of all links
adjacent to deleted nodes, we obtain an ex-post payoff to the Designer given as
uD(g, D, A) =
(
1 − cl|g| − cd|D| if g − X connected,
−cl|g| − cd|D| otherwise,
where g − X is the residual network after the attack. Moreover, defining
Π(g, D, A) as the probability that network g with defense D gets disconnected by attack A, the corresponding expected payoff is given by
EuD(g, D, A) = 1 − Π(g, D, A) − cl|g| − cd|D|.
As we want the Adversary to have the opposite goal of the Designer, we simply define his ex-post utility as
uA(g, D, A) = −uD(g, D, A).
Clearly, the Connectivity Game sets rather extreme incentives for the players. In terms of the Designer he gets a constant payoff of 1 whenever the network is connected and 0 otherwise. Some different utility functions are reasonable and existent in the network design literature, a prominent example being a utility function defined as the sum over all components of functions convex
in component sizes (see e.g. Dziubi´nski and Goyal, 2013). However, retaining
connectivity is still a relevant and important goal in many examples and also constitutes the starting point of the corresponding graph-theoretic literature in the 1960s and 1970s. Moreover, we will see that also in this simple version of the model we will be able to obtain some interesting findings.
The two different defense strategies the Designer has at hand now become apparent. On the one hand, directly defending nodes against deletion at a cost
cdis an obvious strategy, while this defense is supposed to be imperfect in our
model. On the other hand, adding more costly links to the network in order to increase the connectivity constitutes a second strategy of defense, as e.g. a circle network cannot be disconnected by deletion of only one node, independently of node defense. While these two defense strategies clearly behave as substitutes
2
A network g is said to be connected if there exists a path between any two nodes, i.e. for any i, j ∈ N there exist nodes {i, k1, k2, ..., kp−1, kp, j}, such that any two adjacent nodes
(a) Empty g∅ (b) Circle gc (c) CP-star gs
Figure 1: Possible equilibrium networks for n = 6 nodes and attack budget
ka= 1. Green colored node is protected.
in the model, we will see in the following that it may still be optimal to combine both.
The combination of the two defense mechanisms in an optimal defense strategy represents a central difference to the case of perfect defense, which is found
in Dziubi´nski and Goyal (2013) and constitutes the limit case of π = 0 in the
model at hand. It is easy to see that for perfect defense, regardless of the
attack budget ka of the Adversary the optimal strategy for the Designer is one
out of the following three networks: the empty network for high costs, a star
network with protected center, or an unprotected (ka+ 1)-connected network
with minimal number of links (see Figure 1 for ka = 2).3 Thus, in this limit
case the Designer chooses only one out of the two defense mechanisms, either a minimally connected but protected network or an unprotected but highly connected one.
We will now analyze the model first for attack budgets ka= 1 and ka= 2, and
finally for a general attack budget ka≥ 3.
3 Attack Budget 1
We want to start by the analysis of the game in case of an attack budget
ka= 1. While we will see that in this case the possible equilibria do not differ
from the results in the perfect defense framework, we will see that being able to choose between the two available defense strategies (direct defense vs. increased connectivity), directly defending nodes is part of the equilibrium solution for the Designer only for low costs and high success probability of node defense. As a starting point, the following result shows that if the Adversary can attack at most one node, then for any number of nodes n ≥ 3 the equilibrium defended networks are as in Figure 1.
Proposition 1.
Let the attack budget of the Adversary be 1. For any number of nodes n ≥ 3, the set of possible equilibrium defended networks is given by the undefended empty
3
These networks, known as Harary graphs, were identified by Harary (1962) and are known to have ⌈(ka+ 1)n/2⌉ links.
network g∅, the undefended circle gc and the centrally-protected star (henceforth
CP-star) gs.
• The circle is the equilibrium defended network if cl≤ 1/n and cl≤ cd+ π.
• The empty network is the equilibrium defended network if cl ≥ 1/n and
cd≥ 1 − π − (n − 1)cl.
• The CP-star is the equilibrium defended network if cd≤ 1 − π − (n − 1)cl
and cd≤ cl− π.
The proof is rather immediate, understanding that the gc is the Harary graph
of order 2, and the star is the tree with the lowest number of essential nodes.
Proof. 1. There cannot be any equilibrium network ˜g with or without defense
with m > n links, as
uD(˜g, D, A) ≤ 1 − mcl< 1 − ncl = uD(gC, ∅, A) ∀D, A ∈ N.
2. By Harary (1962) we know that a 2-connected network needs to have at least
n links. Moreover, the circle gc is the unique 2-connected network with n links:
In any 2-connected network with n links each node has exactly 2 links. Thus deleting one node results by definition in a 1-connected residual network with n − 1 nodes and n − 2 links (a tree), and exactly two leafs, what necessarily constitutes a line. Now, the only possibility to get a 2-connected network out of a line by adding one node and 2 links is constructing a circle.
3. Any 1-connected network trivially has at least n − 1 links. Further, it has to be protected in order to constitute a payoff higher than 0 (the payoff of the empty network). It is clear that in any such tree the leafs are non-essential nodes. The CP-Star is the only tree with a unique essential node.
4. No non-connected network can generate higher payoff than the empty net-work (same revenue, lower costs).
5. The cost combinations given in Proposition 1 are immediately result from the comparison of the expected utility to the Designer yielded by the three
networks g∅, gc and gs.
The equilibria for different costs are depicted in Figure 2, for π ∈ {0, 1/(4n), 1/(2n), 3/(4n), 1/n}. Why it is enough to consider a maximum π of 1/n is shown in the following Lemma.
Lemma 1.
cd cl gc g∅ gs 1 0 0 3 4n 2 4n 1 4n 1 n 1 n 1 n−1
Figure 2: Equilibrium defended networks for π ∈ [0, 1/n]. As the success prob-ability of attack π increases, the triangle region, where the CP-star is the optimal defended network, shrinks. For π > 1/n (black lines), the CP-star cannot be an equilibrium any more.
Proof. The utility of the Designer from choosing the circle or the CP-star is
uD(gc, ∅, A) = 1 − ncl,
uD(gs, {1}, {1}) = 1 − π − (n − 1)cl− cd,
such that she would prefer the CP-star over the circle whenever
π + cd≤ cl. (3.1)
If now π > 1n, inequality (3.1) yields cl > n1 for any positive defense costs cd,
and consequently
uD(gc, ∅, A) = 1 − ncl< 0 = uD(g∅, ∅, A),
uD(gs, {1}, {1}) = 1 − π − (n − 1)cl− cd< 0 = uD(g∅, ∅, A),
such that the Designer will prefer to choose the unprotected empty network. Notice that this result does not depend on the relative sizes of payoff and costs. The threshold π = 1/n stays the same if the payoff would increase linearly in the number of nodes, i.e. if we considered a payoff in case of successful defense
˜
Lemma 1 has also a direct consequence for large networks. The following corol-lary can also be understood as a limit analysis for n → ∞.
Corollary 1.
For any positive success probability π and large enough network size n, a de-fended network cannot be an equilibrium.
We see that especially for large networks, as the Designer has the choice between the two defense mechanisms of direct defense and high network connectivity, the possibility of unsuccessful defense in most cases lets her decide in favor of higher connectivity of the network.
In the following section we will see that the picture slightly changes if the attack
budget of the Adversary increases. Already for an attack budget ka = 2 the
Designer suddenly also has “intermediate” choices, i.e. it may be optimal for her to choose a network including a degree of connectivity larger than 1 and at the same time defending some nodes.
4 Attack Budget 2
We want to characterize the possible equilibrium defended networks in case of
an attack budget ka = 2 to the Adversary. We will find that the networks we
found in the previous section are still part of the solution. In fact, in Section 5 we will define a set of possible equilibrium defended networks recursively. What notably complicates the following analysis as compared to the previous section is that the Designer from now on has not only the possibility to choose between defending the network by either strategically defending essential nodes or increasing the network connectivity, but combining these two measures by constructing 2-connected networks with a strict subset of nodes being essential and thus defended.
Before turning to the results we want to further elaborate on this central point by presenting an easily accessible example.
Example 1.The set of possible equilibrium defended networks for n = 8 nodes
and 2 units of attack are the empty network g∅, the CP-star gs, the fully
defended circle gc and the Harary graph of order 3 gh,3 (the wheel),together
with a bipartite network of groups 3 and 5, where the smaller group is protected.
All these networks are depicted in Figure 3.4
Instead of presenting all lengthy calculations to determine cost regions for each
4
Dziubi´nski and Goyal (2013) present a similar example, however for a total number of nodes n = 6. The authors happen to miss the fact that for such a low number of nodes the maximal bipartite network with group sizes 2 and 4, the smaller group being fully defended, cannot be payoff-better than both the circle (Figure 3b) and the Harary graph of order 3 ( Figure 3d).
(a) g∅ (b) gs (c) gc
(d) g∗
(e) gh,3
Figure 3: Possible equilibrium networks for n = 8 nodes and attack budget
ka= 2. Green colored nodes are protected.
network to be the equilibrium solution, in this example we show the solutions
graphically in Figure 4 for various values of π.5 The figures show that indeed
there exist cost ranges and values of π for each of the 5 networks to be the
equilibrium solution of the network design game. While g∗ is only a possible
solution for low but positive success probability of attack π and low costs, obviously all networks with defended nodes vanish as solutions for large π.
Let us now start the analysis of the game in case of ka= 2 by collecting some
first intuitive and easily provable facts. Lemma 2.
Let the attack budget be ka= 2. The following statements hold true.
• The only possible non-connected equilibrium defended network is the
un-defended empty network g∅.
• The only possible 1-connected equilibrium defended network is the CP-star
gs.
• The only possible 3-connected equilibrium defended network is the
unde-fended Harary graph of order 3, gh,3.6
All of these statements are the same or equivalent to those in the previous section (Proposition 1), such that a proof can be omitted here.
So far, we have found nothing qualitatively different from the previous case,
5
The corresponding calculations are of course available from the author.
6
It should be clear that this result does not only include all wheels but all 3-connected networks with ⌈3n/2⌉.
0 0.4 1 n−1 cl cd (a) π = 0 0 0.4 1 n−1 cl cd (b) π = 0.05 0 0.4 1 n−1 cl cd (c) π = 0.1 0 0.4 1 n−1 cl cd (d) π = 0.2 0 0.4 1 n−1 cl cd (e) π = 0.3 0 0.4 1 n−1 cl cd (f) π = 0.5
Figure 4: Equilibrium defended networks for all values of cland cd, for different
values of π. Grey area gh, white area g∅, yellow area gs, green area
gc, red area g∗.
as the networks that are equilibria in the boundary case of perfect defense are necessarily part of the solution here. However, in the following we will show that in the class of 2-connected networks there are more candidates to be found. To provide some intuition why we should expect more possible equilibrium defended networks in the class of 2-connected networks, notice that the expected payoff of the CP-star is 1 − π, while of the Harary graph of order 3 it is 1, net
of costs. Any 2-connected network will yield a payoff of 1 − π2, net of costs.
Clearly it is
1 ≥ 1 − π2 ≥ 1 − π ∀π ∈ [0, 1],
such that we can see that whenever we can find a network 2-connected network with less links than the Harary graph, there will be a cost level such that for low π this network may be payoff-better in expected terms. On the other side, the network may make use of more links and more defense than the CP-star, as it yields a higher probability of success.
In order to find these 2-connected networks, we first need to identify optimal combinations of links and essential nodes. As link formation and units of defense are costly, the Designer needs to make sure that for any number of defended nodes, she uses the smallest possible number of links to create the network. In the following, we will call a network minimal if there does not exist another network with the same number of essential nodes and degree of connectedness
and strictly less links.7
7
We will first present a lemma that essentially tells us that we have to distinguish not 2 groups of nodes (essential and non-essential), but 3 groups of nodes. The reason is that an essential node that is connected to non-essential nodes needs to have more links than one that is not. We will also collect some properties of nodes in each group.
Lemma 3.
In minimal 2-connected networks with p essential nodes
• the q = n − p non-essential nodes have at least 2 links, both to essential nodes.
• the pq≤ p essential nodes that are connected to non-essential nodes have
at least 3 links.
• the remaining p − pq essential nodes have at least 2 links.
The proof is the special case ka= 2 of Lemma 5 in the following section.
Notice that we have already established two lower bounds for the number of links. First, any node has at least two links, yielding a lower bound of n links in the network. Second, the first bullet point of Lemma 3 yields a lower bound of 2q links. While for small q this lower bound may be even lower than the other one, we will in the subsequent proposition that it will be tight for large enough q.
The following proposition will now give the minimum number of links necessary to construct a 2-connected network with given number of essential nodes. The
main idea will be to find the optimal number of nodes pq of essential nodes to
have links to non-essential nodes. Proposition 2.
Let n ≥ 4. The minimum number of links in a 2-connected network with 2 ≤ q ≤ n − 2 non-essential nodes is
2q + [p − pq+ 1] 1{p>pq}+ 1{p=pq,3p>2q}, (4.1)
where N (q) ⊆ P is the minimal set of neighbors such that
pq= min p, max 2, 2(q + 1) 3 . (4.2)
In the proof, we first show that (4.1) is a lower bound for such networks by combining the ideas of Lemma 3, and then show that networks with these specifications can indeed be constructed.
easy to construct a network where all links are essential but there exists a different network with the same degree of connectedness and the same number of essential nodes, but less links.
Proof. Denote by P the set of essential nodes and Q the set of non-essential
nodes. Let finally Pq ⊆ P denote those nodes in P that are connected to nodes
in Q.
To establish 4.1 as a lower bound for the number of links needed to construct a 2-connected network with q non-essential nodes, we observe that this is a
special case of the more general Proposition 4, for ka = 2. Then it is easy to
understand that (5.1) collapses to (4.1), for q > 1.
To understand that (5.2) in case of ka= 2 collapses to (4.2) observe first that
ka(q + 1) − 1 − 1{ka[p−(kaq−3)/(ka+1)] even} ka+ 1 ka=2 = 2q + 1 − 1{2[p−(2q−3)/3] even} 3 = 2q + 1 − 1{q/3∈N} 3 = 2q + 1{q/3 /∈N} 3 , and then 2q + 1{q/3 /∈N} 3 = 2(q + 1) 3 . This already establishes the lower bound.
It is left to show that for each n, q a 2-connected network with links as in (4.1)
exists. In order to understand that observe that for p > pq the number of nodes
in pq is ⌊2(q + 1)/3⌋, and thus the Harary graph of order 3 for pq nodes has
q + 1 links.
Connecting each two nodes in Pqvia at least one node in Q or a line of all nodes
in P \Pq. If Pq = P and 3p > 2q then one direct link must be added. Figures
5a - 5c show examples of such minimal networks.
Finally, it is clear that this construction is only valid for Pq ≥ 4. However,
for smaller Pq the construction is straightforward, as is shown in Figures 5d
-5f.
In Figure 6 the minimum number of links given by Proposition 2 are shown for all possible numbers of essential nodes, for the cases of n = 15 and n = 17 nodes in the network. What is left is to determine those networks within this set of candidates who may indeed be equilibrium solutions of the defense game,
for specific combinations of costs cland cd, as well as attack probability π. The
following proposition will identify these networks by making use of the linearity of costs. The idea of the proof can also be seen in Figure 6. By linearity of
costs, and as all 2-connected networks yield the same payoff of 1 − π2, net of
costs, the possible equilibrium defended networks are those lying on the lower
left side of the convex hull of all points given by Proposition 2 in the cost space.8
8
(a) n = 10, q = 6 (b) n = 9, q = 5 (c) n = 12, q = 5
(d) n = 8, q = 4 (e) n = 10, q = 3 (f) n = 7, q = 2
Figure 5: Minimal 2-connected networks for different n, q. Green colored nodes are essential.
Proposition 3.
Let n ≥ 7. The set of possible equilibrium defended networks is given by Λ(n) =
(
{g∅, gh,3, gs, gc, g∗} if n ≡ 0, 3, 4mod 5
{g∅, gh,3, gs, gc, g∗, ˜g} if n ≡ 1, 2mod 5,
where g∅ the undefended empty network, gh,3 the undefended Harary graph of
order 3, gs the CP-star, gc the completely defended circle, g∗ the minimal
2-connected network for q∗= ⌈(3n − 2)/5⌉, and ˜g a network such that p = p∗+ 2
and L(˜g) = L(g∗) − 1.
Proof. The proof is structured in five parts.
1. For any p < p∗, the minimal network cannot be payoff-better than both g∗
and gh,3.
Observe first that q∗ is the minimal number of essential nodes such that p∗
q = p∗,
not only for permutations of the set of nodes but also for all networks that have the same degree of connectedness and contain the same number of links as well as of essential and non-essential nodes. There are, for example, many ways to construct Harary graphs of higher orders.
as otherwise by Equation (4.2) it would need to hold that p∗q = $ 2(⌈3n−25 ⌉ + 1) 3 % < n − 3n − 2 5 ⇐⇒ n > $ 2(⌈3n−25 ⌉) 3 + 2 3+ 3n − 2 5 % ⇐⇒ n > 5 3 3n − 2 5 +2 3 > 5 3 3 5n − 2 5 +2 3 = n,
what constitutes a contradiction. Equivalently, for q = q∗− 1
pq = $ 2(⌈3n−25 ⌉ − 1 + 1) 3 % = n − 3n − 2 5 − 1 = p ⇐⇒ n = 5 3⌈ 3n − 2 5 ⌉ − 1 ⇐⇒ n ≤ 5 3( 3n − 2 5 + 1) − 1 = n − 2 5 = n − 1, what is again a contradiction.
Thus, in this network the number of links is 2q∗+ 1{3n>5q} by Equation (4.1),
and as q∗ = ⌈(3n − 2)/5⌉ it is
3n > 5q∗ ⇐⇒ n ≡ 2, 4mod 5.
Moreover, we know that for any g such that q > q∗it is |g| = 2q, by Proposition
2, as 3n < 5(q∗+ 1) ≤ 5q. For this network g to be an equilibrium solution, it
needs to hold that
|g|cl+ pcd≤ |g∗|cl+ p∗cd (4.3)
|g|cl+ pcd≤ 3n
2
cl+ 0cd, (4.4)
in order to be payoff-better than both g∗ and the Harary graph of order 3.
We show that these two equations cannot both be satisfied for g such that
q = q∗+ 1 and therefore |g| = 2(q∗+ 1). For all ¯q > q∗+ 1 the proof is then a
direct consequence. Equation (4.3) yields
2(q∗+ 1)cl+ (p∗− 1)cd≤ (2q∗+ 1)cl+ p∗cd
⇐⇒ cl ≤ cd, (4.5)
where we used that |g∗| ≤ 2q∗+ 1. On the other hand, Equation (4.4) yields
2(q∗+ 1)cl+ (p∗− 1)cd≤ 3n 2 cl ⇐⇒ 3n 2 − 2 3n − 2 5 − 2 cl ≥ n − 3n − 2 5 − 1 cd. (4.6)
Now, for both (4.5) and (4.6) to be satisfied at the same time it needs to hold that 3n 2 − 2 3n − 2 5 − 2 ≥ n − 3n − 2 5 − 1 ⇐⇒ 3n 2 − n ≥ 3n − 2 5 + 1, while 1 2n + 1 ≥ 3n 2 | {z } ≤3n2 +1 −n ≥ 3n − 2 5 | {z } ≥3n−25 +1 ≥ 3n − 2 5 + 1 ⇐⇒ 1 2n ≥ 3n − 2 5 ⇐⇒ n ≤ 4,
what is a contradiction to the assumption that n ≥ 7.
2. For n > p > p∗, the only possible networks satisfy n − p = 3r + 2 for r ≥ 0.
For n > p > p∗, we know that pq < p and thus the number of links in a
corresponding network g is
2q + [p − pq+ 1] ,
for pq defined as in (4.2). Comparing two minimal networks g and ˜g with q and
q + 1 non-essential nodes, it is
2(q + 1) + [p − 1 − pq+1+ 1] − 2q − [p − pq+ 1]
=1 − (pq+1− pq),
such that whenever pq+1 = pq+ 1 then g cannot be an equilibrium defended
network because for ˜g corresponding to q + 1 the network has the same number
of links while having one essential node less.
Observe now that for pq< p we have that pq= ⌊2(q + 1)/3⌋ and thus we know
that the only possible equilibrium defended networks satisfy q = 3r + 2 for r ≥ 0.
3. For any of these, only the maximum (i.e. the one with maximal r) is possible.
Denote this by gr.
Take two networks gr−1 and gr, where 0 ≤ r − 1 < r and qr−1 = 2 + 3(r − 1),
qr = 2 + 3r. For gr−1 to be an equilibrium defended network for some cost level
it needs to be payoff-better than both gr and the completely defended circle.
(n − 2 − 3(r − 1))cd+ (n + r)cl≤ (n − 2 − 3r)cd+ (n + r + 1)cl
(n − 2 − 3(r − 1))cd+ (n + r)cl≤ ncd+ ncl
what translates to
3cd≤ cl
what cannot be both satisfied at the same time.
4. For n ≡ 3, 4mod 5, n − p∗ = 3(r + 1) + 2, thus gr cannot be an equilibrium
defended network by the arguments of step 3. Let n ≡ 3, 4mod 5, then
q∗= 3n − 2 5 = 3n 5 .
For n = 8, it is q∗ = 5 = 3 · 1 + 2, and for n = 8 + 5r, r ≥ 1 it is thus
q∗ = 3n 5 = 3 · 8 + 15r 5 = 3(r + 1) + 2. For n = 9 + 5r the same argument yields the result.
both5. For n ≡ 0mod 5, n − p∗ = 3r, while |g∗| = |gr|, thus gr cannot be an
equilibrium defended network, as g∗ will be cheaper for all positive costs cd.
Let n ≡ 0mod 5, then
q∗ = 3n − 2
5
= 3n
5 ,
and thus for n = 5r, r ≥ 1 it is q∗ = 3r.
Now, it is by (4.1) |L(g∗)| = 2q∗, as 3(5r − 3r) = 2 · 3r, and |L(gr)| = 2(q∗− 1) + 2 = 2q∗, as in gr it is p q= p − 1.
In Figure 6, for all numbers of essential nodes, the minimum number of neces-sary links to construct a 2-connected network is given, and the possible equi-librium defended networks as given in Proposition 3 are identified. This shows that indeed all of the networks given in Proposition 3 are possible equilibrium solutions of the defense game.
Note finally that in the definition of the game in Section 2 we did not allow the Adversary to attack the same node twice instead of attacking two different
nodes. However, in case of ka = 2 we can now see that this would not change
the results qualitatively, as the only possibility would be to attack the CP-star center node twice. However, as
(1 − π)2 < 1 − π2 ⇐⇒ π < 1,
0 5 10 15 14 16 18 20 22 24 26 |L (g )| p (a) n = 15 0 4 8 12 16 16 18 20 22 24 26 28 30 (b) n = 17
Figure 6: Possible 2-connected equilibrium defended networks for n = 15, n = 17.
π=0.15 0 0 0.1 0.2 0.3 0.4 1/⌈3n/2⌉ 1/(n − 1) g∅ gh gs g∗ gc cd cl (a) n = 15, π = 0.15 π=0.08 0 0 0.1 1/⌈3n/2⌉ g∅ gh gs g∗ gr gc cd cl (b) n = 17, π = 0.08
Figure 7: Equilibrium defended networks for n = 15, n = 17, for a given defense probability π and all cost combinations.
Limit behavior
In Section 3 we saw that the only defended network, the CP-star, was not part of the solution set if the number of nodes n was big enough compared to the destruction probability π. We now argue that this result does not hold
anymore already in the present case of ka= 2. The main reason for this is that
the difference in links between the star and the unprotected Harary graph is now growing in n. Precisely, we have
uD(gs, {c}, {c}) = 1 − π − (n − 1)cl− cd, uD(gh,3, ∅, A) = 1 − ⌈3n2 ⌉cl, and thus uD(gh,3, ∅, A) ≥ uD(gs, c, c) ⇐⇒ ⌈3n2 ⌉ − (n − 1) | {z } n→∞ −→ n2 cl≤ π + cd,
such that we see that here in the limit of n → ∞ only for zero link costs the Harary graph of order 3 can be payoff-better than the CP-star.
Again, we can instead of uD alternatively consider a utility function where the
payoff grows with the number of nodes in the network. As in the previous
Section, consider a utility function ˜uD, where in case of a connected residual
network the payoff is ˜
uD(g, D, A) = n − cl|g| − cd|D|,
and consider again the payoff of gs and gh,3. One gets
˜
uD(gh,3, ∅, A) ≥ ˜uD(gs, {c}, {c})
⇐⇒ ⌈3n2 ⌉ − (n − 1)cl≤ nπ + cd.
This yields that in the limit n → ∞ the Harary graph of order 3 is payoff-better than the CP-star if and only if
1
2cl ≤ π,
such that again the CP-star is a possible solution of the defense game for any network size.
Having fully characterized the set of possible equilibrium defended networks for
an attack budget of ka= 2, we now have an idea how to approach the problem
for a general attack budget. However, while the ideas will stay the same, there will arise some problems forcing us to only partially characterize the solution in the general setup.
5 Attack Budget k
aWe now want to accomplish the same analysis of the previous section for a
general attack budget ka. The idea will be the same as before, such that
we need to characterize the minimum number of links needed to construct
a ka-connected network with a given number of p essential links. Observe
however that we now have to consider a lot more networks, as for any degree
of connectedness 1 ≤ k < ka there may still be networks that are part of the
solution. This fact makes it impossible for us to completely characterize the set of possible equilibrium defended networks Λ(n). However, we will show that some obvious candidates are part of the solution and we will furthermore
define a set of networks that we can show to include all possible ka-connected
equilibrium defended networks.
We start again with a lemma that comprises some first and easily derivable results, where we see that the obvious candidates, that is the empty network,
the CP-star and the Harary graph of ka+ 1 are again part of the solution.
Lemma 4.
Let the attack budget be ka. The following statements hold true.
• The only possible non-connected equilibrium defended network is the
un-defended empty network g∅.
• The only possible 1-connected equilibrium defended network is the CP-star
gs.
• The only possible (ka+ 1)-connected equilibrium defended network is the
undefended Harary graph of order ka+ 1, gh,ka+1.
Again we omit a proof, as it is structurally equivalent to the proof of Proposition 1 in Section 3.
Instead, we turn to characterize more possible equilibria of the defense game. Intuitively it should be clear that in the general case we get a more diverse set of possible equilibrium defended networks. While it is easy to characterize
the networks that are non-connected, 1-connected or (ka+ 1) connected (as we
saw in the previous Lemma), we now also have to think about all networks of
connectivity 2, 3, ..., ka, and each time with any number of essential nodes.
To assess this problem we aim to partially characterize the set Λ(n, ka) of
possi-ble equilibrium defended networks by recursively identifying a class of networks
Γ(n, ka) that we can show to include Λ(n, ka). The idea will be the same as
in the previous section: We identify the minimal ka-connected networks for
any number of essential nodes and subsequently identify those that may be a solution to the game by exploiting the linearity of costs.
nodes in a ka-connected network. Lemma 5.
In minimal ka-connected networks with p essential nodes, the q = n − p
non-essential nodes have at least ka links, all of them to essential nodes. Thus, any
such network has at least kaq links.
Proof. Remember that it is clear that any node in a ka-connected network has
at least kalinks, as the deletion of all neighbors leaves a node isolated and thus
disconnects a network.
Let now ¯g be a network such that P = {1, .., p} are the essential nodes. Suppose
further that ¯g contains a link between two nodes i, j /∈ P . Then it is clear that
¯
g − ij is again ka-connected with the same set of separators. To see that note
that by Menger’s Theorem there are at least ka node-disjoint paths between
any two nodes in ¯g, and as (N − P ) are non-separating there are also at least
ka node-disjoint paths between any two nodes in N \{i} for any i ∈ (N − P ).
Then it is already clear that all of these paths remain existing in ¯g − ij, leaving
the connectivity and the set of non-separators unchanged.
Suppose now there are no links between non-separating nodes. Knowing that
any node in a ka-connected network has at least kalinks we know that there are
kaq nodes from non-separating to separating nodes, what yields the result.
We now characterize all minimal ka-connected equilibrium defended networks.
Remember first that the minimal ka-connected network has ⌈kan/2⌉ links. We
denote this network by gh,ka, the Harary graph of order k
a. It is clear that in
this network all nodes are essential, such that the possible equilibrium defended network is the fully defended Harary graph.
Similar to the case of ka = 2 in Section 4, we can now deduce the number of
links necessary to construct a ka-connected network with exactly p essential
nodes, i.e. p nodes contained in separating ka-cuts. Remember that by Lemma
5 the q = n − p non-essential nodes all have exactly ka links, all of them to
essential nodes, yielding a lower bound of kaq links. Moreover, we know that
any neighbor of a non-essential node has to have at least ka+ 1 links. Thus
the idea is, again similar to Section 4, to determine the optimal number pq of
essential nodes connected to non-essential nodes.
A remaining issue is the construction of the networks we find. The idea in the previous section was to establish the number of links as a lower bound and subsequently provide a construction algorithm for a network of this degree of connectedness, as well as numbers of essential nodes and links. In this general case we will also provide a construction algorithm for a network and argue that it is a valid candidate. However, a proof for this conjecture is not provided. Notice therefore that the following proposition only provides a lower bound on the number of links, while afterwards we will add the conjecture and the construction algorithm for the networks.
Proposition 4.
Let n be big enough, then a lower bound for the minimum number of links in a
ka-connected network with 1 ≤ q ≤ n − ka non-essential nodes is given by
G(pq) = ka(q + 1) + lmax{0,(k a+1)pq−ka(q+1)}+ka(p−pq−1) 2 m if pq< p, kaq + lmax{0,(k a+1)pq−kaq} 2 m if pq= p, (5.1)
where pq= |Pq| and Pq⊆ P is the set of neighbors of non-essential nodes, such
that pq= min p, max ka, ka(q + 1) − 1 − 1{ka[p−(kaq−3)/(ka+1)] even} ka+ 1 . (5.2)
Proof. 1. G(pq) as defined in (5.1) is a lower bound for a ka-connected network
of q non-essential nodes with pq neighbors.
By Lemma 5, it is clear that non-essential neighbors have exactly ka links.
Further, there need to be at least ka links between the pq neighbors of
non-essential nodes and the remaining p−pqessential nodes, yielding kaq+ka1{p>pq}
links. Moreover, the pq neighbors of non-essential nodes need to have at least
ka+ 1 links, while the remaining p − pq nodes need to have at least ka links,
what together yields (5.1).
2. To determine the minimum number of links, we need to find the pq that
minimizes (5.1). It is enough to find the minimum pqsuch that G(pq) ≤ G(pq+
1) and to show that for this pq it is also G(pq) ≤ G(pq− 1).
Define F (pq) to be equal to G(pq) − kaq when disregarding the ceiling function,
i.e. F (pq) = ( k + max{0,(ka+1)pq−ka(q+1)}+ka(p−pq−1) 2 if pq< p, max{0,(ka+1)pq−kaq} 2 if pq= p,
then for G(pq) ≤ G(pq+1), it is either F (pq) ≤ F (pq+1) or F (pq) = F (pq+1)+12
and
max{0, (ka+ 1)pq− kaq − ka1{p>pq}} + ka(p − pq− 1)1{p>pq} (5.3)
even.
Consider the first of these two cases. We need to distinguish between pq< p − 1
and pq= p − 1. • pq< p − 1. Then F (pq) ≤ F (pq+ 1) ⇐⇒ max{0, (ka+ 1)pq− ka(q + 1)} + ka(p − pq− 1) ≤ max{0, (ka+ 1)(pq+ 1) − ka(q + 1)} + ka(p − pq− 2) ⇐⇒ max{0, (ka+ 1)pq− ka(q + 1)} + ka≤ max{0, (ka+ 1)pq− kaq + 1} ⇐⇒ pq ≥ ka(q + 1) − 1 ka+ 1 .
• pq= p − 1. Then F (pq) ≤ F (pq+ 1) ⇐⇒ ka+ max{0, (ka+ 1)pq− ka(q + 1)}/2 ≤ max{0, (ka+ 1)(pq+ 1) − kaq}/2 ⇐⇒ 2ka+ max{0, (ka+ 1)pq− ka(q + 1)} ≤ max{0, (ka+ 1)pq− kaq + ka+ 1}/2 ⇐⇒ pq ≥ ka(q + 1) − 1 ka+ 1 .
We observe that the two boundaries coincide.
Consider instead the second case, such that F (pq) = F (pq+ 1) + 12 and (5.3)
even. We again distinguish pq < p − 1 and pq= p − 1
• pq< p − 1. Then F (pq) − F (pq+ 1) = 12 ⇐⇒ [max{0, (ka+ 1)pq− ka(q + 1)} + ka(p − pq− 1)]/2 − [max{0, (ka+ 1)pq− kaq + 1} − ka(p − pq− 2)]/2 = 12 ⇐⇒ max{0, (ka+ 1)pq− ka(q + 1)} + ka − max{0, (ka+ 1)pq− kaq + 1} = 1 ⇐⇒ max{0, (ka+ 1)pq− kaq + 1} − max{0, (ka+ 1)pq− ka(q + 1)} = ka− 1 ⇐⇒ pq= ka(q + 1) − 2 ka+ 1 . • pq= p − 1. Then F (pq) − F (pq+ 1) = 12 ⇐⇒ ka+max{0, (ka+ 1)pq− ka(q + 1)} − max{0, (ka+ 1)pq− kaq + ka+ 1}/2 = 12 ⇐⇒ max{0, (ka+ 1)pq− kaq + ka+ 1} − max{0, (ka+ 1)pq− ka(q + 1)} = 2ka− 1 ⇐⇒ pq= ka(q + 1) − 2 ka+ 1 .
into (5.3) and notice that the maximum functions are zero, such that max{0, (ka+ 1)¯pq− kaq − ka1{p>¯pq}} + ka(p − ¯pq− 1)1{p>¯pq} =ka p −ka(q + 1) − 2 ka+ 1 − 1 =ka p −kaq − 3 ka+ 1 , (5.4)
such that we know that the condition simplifies to (5.4) being even.
It is left to show that for the optimal pq as defined in (5.2) it is also G(pq) ≤
G(pq − 1). We will consider the sufficient criterion F (pq) ≤ F (pq − 1) and
show that this is always satisfied for pq given by (5.2). Observe that we only
need to consider pq < p here, as otherwise the above the above would yield
G(p − 1) > G(p) and we would directly know that pq= p is optimal. Thus, for
pq< p it is F (pq) ≤ F (pq− 1) ⇐⇒ max{0, (ka+ 1)pq− ka(q + 1)} + ka(p − pq− 1) ≤ max{0, (ka+ 1)pq− ka(q + 2) − 1} + ka(p − pq) ⇐⇒ max{0, (ka+ 1)pq− ka(q + 1)} − max{0, (ka+ 1)pq− ka(q + 2) − 1} ≤ ka ⇐⇒ pq≤ ka(q + 2) ka+ 1 ,
and it is clear that for all ka≥ 1
ka(q + 1) − 2
ka+ 1
≤ ka(q + 2)
ka+ 1
.
Altogether, we have now shown that (5.1) and (5.2) yield a lower bound for a
ka-connected network with p critical links.
In the following it is argued that the lower bound given in Proposition 4 might be tight, meaning that there indeed exist networks of any given degree of con-nectedness and number of essential nodes, that have exactly the number of links given in (5.1) and (5.2) of Proposition 4. We formally give this statement in the following conjecture and will subsequently present a corresponding construction algorithm.
Conjecture 1.
G(pq) as given by (5.1) and (5.2) is the minimum number of links in a ka
-connected network with 1 ≤ q ≤ n − ka non-essential nodes.
The idea is to construct such a ka-connected network with exactly G(pq) links.
Proposition 4 then guarantees that there cannot be a network with the given characteristics and less links.
Consider the following construction. Define the set of non-essential nodes as
Q = {n1, ..., nq}, their neighbors Pq= {c1, ..., cpq} and all other essential nodes
P \Pq as {cpq+1, ..., cp}. Consider now the following construction. Let pq < q
and pq = p. Then for i = 1, ..., p, ni is connected to ci, ..., ci+ka−1 (mod p),
while for i = p + 1, ..., q, ni is connected to ci−p, ci−p+⌈p/ka⌉, ..., ci−p+(ka−1)⌈p/ka⌉
(mod p). If q − p < ⌈kp
a⌉, then connect the smallest ci with ka links to ci+⌈p/ka⌉
(mod p), until all essential nodes have ka+ 1 neighbors.
Let pq < q and pq< p. Again, for i = 1, ..., pq, ni is connected to ci, ..., ci+ka−1
(mod pq), while for i = pq+ 1, ..., q, ni is connected to
ci−pq, ci−pq+⌈pq/ka⌉, ..., ci−pq+(ka−1)⌈pq/ka⌉ (mod pq).
Now, the nodes cpq+1, ..., cpform a Harary graph of order kain the following way.
Consider the nodes cq−pq+1, cq−pq+1+⌈pq/ka⌉, ..., cq−pq+1+(ka−1)⌈pq/ka⌉ (mod pq)
as being one node ˜c. Then cpq+1, ..., cp and ˜c form a Harary graph of order
ka, where each node in ˜c gets one connection. Finally, if one of the nodes in
cpq+1, ..., cp and ˜c has ka+ 1 links and there exists a node in c1, ..., cpq having
only kalinks, w.l.o.g. the node with ka+ 1 links will be ˜c, where the node with
smallest index in c1, ..., cpq having only ka links is added to ˜c.
Finally, if still nodes in c1, ..., cpq have only ka links, then connect the smallest
ci with ka links to ci+⌈p/ka⌉ (mod pq), until all essential nodes have ka+ 1
neighbors.
In this construction, if cpq+1, ..., cp are less than ka nodes, the formation of a
Harary graph is not possible. This is the case as
ka(p − pq+ 1) 2 > (p − pq+ 1)(p − pq) 2 ⇐⇒ ka(p − pq+ 1) 2 > (p − pq+ 1)(p − pq) 2 ∨ ka= p − 1 ∧ kap odd,
where the latter case is a contradiction, while the first case yields the above
condition. In this case cpq+1, ..., cp form a completely connected subgraph of
and all of them are additionally connected to ka− (p − pq− 1) nodes from
cq−pq+1, cq−pq+1+⌈pq/ka⌉, ..., cq−pq+1+(ka−1)⌈pq/ka⌉(mod pq) as well as those nodes
in c1, ..., cpq having only ka links.
Finally, let pq ≥ q. Observe that for ka≥ 3 this can only be the case if q ≤ ka,
as from (5.2) it follows that
pq= ka
⇐⇒ ka(q + 1) − 1 − 1{ka[p−(kaq−3)/(ka+1)] even}
ka+ 1
and for q = ka+ 1 it is ka(ka+ 2) − 1 − 1{ka[p−(kaq−3)/(ka+1)] even} ka+ 1 = ka+ ka− 1 − 1{ka[p−(kaq−3)/(ka+1)] even} ka+ 1 ka>2 = ka+ 1.
Having understood this, we deduce that q ≤ pq = ka, as any non-essential node
has to be connected to ka distinct essential nodes.
The construction in this case works as follows. All nodes in Q are connected
to all nodes in Pq, such that the ka nodes in Pq each have q links. Notice that
these nodes need at least one more link each.
Now, consider as before all nodes in Pq as one artificial node ˜c. Then all nodes
in P \Pq together with ˜c form a Harary graph of order ka, where the ka links
of ˜c are divided such that every node get one of the links. Finally, there might
be links missing in Pq. If every node misses one link, then add links in pairs.
If they lack more links, then add a Harary graph of this degree for all nodes in
Pq.
Argumentation for Conjecture 1. Consider first a network constructed as above
for the case where pq = q. Consider furthermore ka = 3. For such an
exam-ple consider Figure 8. In the following we will distinguish non-essential nodes
Q between “outside” nodes n1, ..., npq, and “inside” nodes nt, t > pq. This
terminology is motivated by the above construction, see Figures 8 and 9. We need to show that there exist three node-distinct paths between any two nodes in the network, while not using one arbitrary non-essential node.
This can however be heavily simplified. We will instead show that there exist
1) three different paths between any two nodes in Pq, 2) node-distinct paths
from any 3 nodes in Pq to any other 3 nodes in Pq, and 3) node-distinct paths
from any node in Pq to any 3 nodes in Pq, while we are always free not to use
one arbitrary node in Q.
1) Take any two nodes in Pq, call them cs and ct. W.l.o.g. let s < t and call
cs+1, ..., ct−1 the right-hand side and ct+1, .., cs−1 the right-hand side. Observe
that 3 links leave csto the outside, call them the left, middle and right link. The
middle link can leave to the right (node cs+1) or to the left (cs−1). Analogously,
3 links leave ctto the outside. Distinguish now the following cases.
• cs and ct are directly connected through an inside node. Then there are
additionally two paths left and one path right on the outside, or vice versa.
• There is an inside connection from csto some node in Pq on the left-hand
side, and an inside connection from ct to some node on the right-hand
side. Leave cswith two paths to the right, one of which will hit the node
Leave cs to the left and via the inside connection. Both paths will hit ct from the left-hand side, one via the left, one via the middle link.
• There is an inside connection from csto some node in Pq on the left-hand
side, and an inside connection from ctto some node on the left-hand side.
Leave cs with two paths to the right-hand side, hitting ct through the
right and the middle link. Leave cs to the left to encounter the node
connected to ct via the inside. Leave cs via the inside, and continue on
the left-hand side to hit ctvia the left link.
In any case, there are 4 node-distinct paths, such that 3 paths remain whenever one chooses to omit some non-essential node.
2) Take any node cs and any group (ct1, ct2, ct3), all within Pq. Again, one
can find node-distinct paths from cs to the three nodes (ct1, ct2, ct3), while it
is possible not to use one arbitrary non-essential node. If t1, t2, t3 ≤ pq, then
the proof is as in case (1) above, noticing that the three nodes lie on the circle of essential nodes connected to non-essential nodes, such that there is a left, center and right node.
If on the other hand for some ti it is ti > pq, then exchange cti for either the
node cusuch that u ≤ pqand ctiand cuare connected, or if this node is also part
of (ct1, ct2, ct3), any other node ˜cuthat is not part of (ct1, ct2, ct3) and connected
to a node cr such that r > pq. Like this we again reduced the problem to be
similar to case (1).
3) Take any two groups (cs1, cs2, cs3) and (ct1, ct2, ct3) of nodes within Pq. Again,
the same arguments can be used to show that there exist node-distinct paths
from csi to cti, i = 1, 2, 3, with the possibility not to use any non-essential node.
The most difficult case is if (cs1, cs2, cs3) and (ct1, ct2, ct3) lie on two different
sides of the circle c1, .., cpq (if some s1, s2, s3, t1, t2, t3 > pq, the argument works
as in case (2) above). As in case (1) there are two node-distinct paths to the left and two to the right on the outside, while one path may start via the inside. Thus indeed all arguments work as in case (1).
Due to the symmetry of the construction the extension of the above to higher degrees of connectedness is straightforward.
Finally, we want to use the result of Conjecture 1 to characterize the possible
equilibrium defended networks Λ(n, ka) in case of an arbitrary attack budget
ka. To this end we will recursively define a set of network that we can show
to include Λ(n, ka). These networks will be those with minimum number of
essential nodes for any number of links more than the Harary graph gh,ka of
order ka, and less than g∗, which is again the network with the minimum
number of non-essential nodes such that p = pq. Formally, the conjecture is the
following.9
9
Notice that despite the inclusion of a proof the following result remains a conjecture, as this proof relies on the validity of Conjecture 1.
Pajek c1 c2 c3 c4 c5 c6 c7 c8 n1 n2 n3 n4 n5 n6 n7 n8 n9 n10
Figure 8: A 3-connected network of 18 nodes, where 8 are essential and 10 are
non-essential, while pq = p. There are 4 distinct paths between any
two essential nodes. Conjecture 2.
The set of possible ka-connected equilibrium defended networks is a subset of
Γ(n, ka) = {g1min, gmin2 , ..., g∗},
where g∗ is the minimal network with minimum number of non-essential nodes
such that p = pq, while glminfor 1 ≤ l < |g∗|−⌈nk2a⌉ is the network with ⌈nk2a⌉+l
links and the minimum possible number of essential nodes.
To understand the idea of Conjecture 2, consider Figures 10a and 10a. The networks that are possible equilibria of the game are those with optimal com-binations of essential nodes and number of links on the flatter right part of the
graphs. However, one can see that not all of these are necessarily in Λ(n, ka).
Proof. It is clear that no network with more essential nodes than g∗ other than
the gmin
l for 1 ≤ l < |g∗| − ⌈nk2a⌉ can be equilibrium defended networks, as there
always exist one glmin with the same number of links and less essential nodes.
We need to prove that no network with less essential nodes than g∗ can be an
equilibrium defended network. Note first that for these networks it is always
kaq ≥ (ka+ 1)p, (5.5)
as p∗ is the largest to satisfy p∗q = p∗. Let us therefore consider the largest p to
satisfy (5.5), that is let
p = kn 2k + 1 .
Pajek c1 c2 c3 c4 c5 c6 c7 c8 c9 n1 n2 n3 n4 n5 n6 n7
Figure 9: A 3-connected network of 16 nodes, where 9 are essential and 7 are
non-essential, while pq= 6.
The idea will be to calculate the slope of a line between the two points referring
to the network g with p essential nodes and the Harary graph of order ka+ 1
(consider e.g. Figure 10a). We know that g has ka(n − p) links, while gh,ka+1
has ⌈(ka+ 1)n/2⌉ links. This yields a slope of
ka(n − ⌊2kkaa+1n ⌋) − ⌈(ka+1)n2 ⌉ ⌊ kan 2ka+1⌋ ≥ kan − k2 an 2ka+1 − (ka+1)n 2 − 1 kan 2ka+1 = (4ka+ 2)kan − 2k 2 an − (2ka+ 1)(ka+ 1)n − (4ka+ 2) 2kan = −kan + n + 4ka+ 2 2kan .
Further, we know that in order to add one non-essential node at the expense of
one essential node if ˜p ≤ p one needs to add exactly ka links, yielding a slope
of −ka. On the other hand, the above slope is even larger than −1, as
kan + n + 4ka+ 2 2kan ≤ 1 ⇐⇒ kan + n + 4ka+ 2 ≤ 2kan ⇐⇒ n(ka− 1) ≥ 4ka+ 2 ⇐⇒ n ≥ 4ka+ 2 ka− 1 > 4, what yields the result.
replacemen 0 10 20 70 80 90 100 |L (g )| p (a) n = 25 0 10 20 30 75 85 95 105 115 125 |L (g )| p (b) n = 30
Figure 10: Minimal 5-connected networks for n = 25, n = 30. Possible equilib-ria in red circles. The vertical black line marks the largest number
6 Conclusion
We proposed a model of network design with imperfect defense as an
exten-sion of Dziubi´nski and Goyal (2013). The Designer chooses a network for a
given number of nodes and can additionally choose to protect nodes against deletion, where protection is imperfect. Subsequently, the Adversary attacks a fixed number of nodes. In the model at hand, the Designer strives for retain-ing a connected residual network, while the Adversary tries to disconnect the network.
As a first step we succeeded to fully characterize the set of possible equilibria of the game, i.e. the possible equilibrium defended networks, for an attack budget of one or two nodes.
In case of a budget of one, this set consists of the undefended empty network, the centrally-protected star and the unprotected circle. We further showed that the centrally-protected star as the only network using node defense can only be an equilibrium solution for a low number of nodes and a low probability of destruction of defended nodes.
For an attack budget of two nodes we showed that more solutions are possible for the game. The set of possible equilibria is constituted by the unprotected empty network, the centrally-protected star, the fully protected circle, the unprotected wheel, and one or two intermediately defended 2-connected networks, depending on the total number of nodes.
In case of a general attack budget of ka nodes the set of possible equilibrium
defended networks was partially characterized. Given a number of nodes and an attack budget, we defined a group of networks that we demonstrated to include
all possible ka-connected equilibria.
As the main technical contribution we extended the seminal result of Harary (1962), who showed that the k-connected network of n nodes with minimal number of links has ⌈kn/2⌉ links. Similarly, we identified the minimum number of links for a k-connected network with p essential nodes.
Our results suggest that for the problem of optimal network design not only the cost structure is an important variable for the decision, but also the extent of the threat. If the connectivity of a (large) network shall be secured against the threat of a single node-deletion, when high enough connectivity is the best choice. If, in turn, a threat of several simultaneous attacks is given, then facing imperfect defense it may be optimal to mix the two mechanisms of direct node defense and a high degree of connectivity.
Regarding future research, it would be most interesting yet technically chal-lenging to analyze the game for different utility functions. The here proposed connectivity game undoubtedly is a valid starting point for the analysis and already yielded interesting insights, yet one could think of other, presumably more realistic utility functions, e.g. a utility function being additively separable in components of the residual network and convex and increasing in component
sizes (see e.g. Dziubi´nski and Goyal (2013)).
Finally, the literature on network design proposes different rules of attack, such as contagion of attack to connected and unprotected nodes, or even link attack. Regarding these on the basis of imperfect defense would add to the understand-ing of the network design game.
References
Cerdeiro, D., Dziubinski, M., and Goyal, S. (2015). Contagion risk and network design.
Dziubinski, M. and Goyal, S. (2013). How to defend a network? Technical
report, University of Cambridge Working Paper.
Dziubi´nski, M. and Goyal, S. (2013). Network design and defence. Games and
Economic Behavior, 79:30–43.
Goyal, S. and Vigier, A. (2010). Robust networks. Technical report, mimeo, University of Cambridge, Faculty of Economics.
Goyal, S. and Vigier, A. (2013). Attack, defense and contagion in networks. Technical report, Faculty of Economics, University of Cambridge.
Harary, F. (1962). The maximum connectivity of a graph. Proceedings of the National Academy of Sciences of the United States of America, 48(7):1142. Hoyer, B. (2012). Network disruption and the common enemy effect. Tjalling
C. Koopmans Institute Discussion Paper Series, 12(06).
Hoyer, B. and De Jaegher, K. (2010). Strategic network disruption and defense. Tjalling C. Koopmans Institute Discussion Paper Series, 10(13).
